As requested in stripe-php#1653 I report the issue here.

Describe the bug

I don't know if this is the right place to open this issue, but since I use the PHP SDK I thought it appropriate to do it here.

Stripe do not follow RFC 6749 section 4.1.2 in the case of authorization rejected by the user. The state parameter is required in the response if the client_id and redirect_uri in the request are both valid (see also section 4.1.2.1), I quote:

If the resource owner denies the access request or if the request
fails for reasons other than a missing or invalid redirection URI,
the authorization server informs the client by adding the following
parameters to the query component of the redirection URI using the
"application/x-www-form-urlencoded" format, per Appendix B:

....

state
REQUIRED if a "state" parameter was present in the client
authorization request. The exact value received from the
client.

....

Consider implementing the specification according the RFC6749, otherwise cross-site request forgery cannot be verified.

To Reproduce
Steps to reproduce the behavior:

1. paste an authorization url into your browser like: https://marketplace.stripe.com/oauth/v2/authorize?client_id=${clientId}&redirect_uri=${redirectUrl}&state=${state}
2. click "Cancel" on the Stripe authorization page
3. the URL to which the browser is redirected does not have the state parameter: https://*********/oauth2?error=access_denied&error_description=The+user+denied+your+request

Expected behavior
state parameter must be returned unchanged.

Screenshots

• not applicable -

Desktop (please complete the following information):

• OS: Ubuntu 22.04.4 LTS
• Browser Google Chrome
• Version Version 121.0.6167.184 (Official Build) (64-bit)